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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



EDMUND SCARBOROUGH, et al 



Plaintiffs, 



FRANCIS J. HARVEY 

Secretary of the Army, et al 

Defendants, 



Civil Action No. 05-1427 (RBW) 



DEFENDANT'S REPLY TO PLAINTIFF'S OPPOSITION TO 
MOTION TO DISMISS, OR IN THE ALTERNATIVE, FOR PARTIAL SUMMARY 

JUDGMENT 

Defendants file this Reply to Plaintiffs' Opposition to Defendant's Motion to Dismiss, or 

in the Alternative, for Partial Summary Judgment. Defendants request this Court grant its motion 

to dismiss Plaintiffs' complaint for lack of subject matter jurisdiction and failure to state a claim 

upon which relief can be granted. Alternatively, Defendants request this Court grant partial 

summary judgment in their favor because there is no genuine issue of material fact and 

Defendants are entitled to judgment as a matter of law. 



Plaintiffs Lack Standing To Challenge Alleged Privacy Act Violations 

Plaintiffs' complaint alleges the Army and Small Business Administration have 



committed violations of the Privacy Act which have caused Plaintiffs harm. However, the harm 
which Plaintiffs complain about is harm to their business or commercial interest and not harm to 
the Plaintiffs individually. Although listed individually as Plaintiffs, each Plaintiffs' information 
was not information about them individually, but about their commercial interests. 
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An individual has no standing to challenge agency action with regard to records 
pertaining to a business, including a sole proprietorship. 0MB Guidelines, 40 Fed. Reg. At 
28,951; St. Michael's Convalescent Hospital v. California , 643 F.2d 1369, 1373 (9* Cir. 1981) 
(stating that "sole proprietorships are not individuals and thus, lack standing to raise a claim 
under the Privacy Act"). Plaintiffs' claims fall outside the scope of the Privacy Act because even 
assuming all of Plaintiffs' allegations are true, each Count in the Amended Complaint is 
premised on the alleged disclosure of entrepreneurial information, rather than personal 
information. 

The Privacy Act is designed to protect against individual harms as a result of an agency's 
inappropriate use of information systems. The harms that Plaintiffs complain of are not 
individual in nature, but commercial or entrepreneurial. Plaintiffs Scarborough, Wright, and 
Gowen were involved in writing, proposing, and marketing bonds for Army, Navy, and Air Force 
contracts. Hamblen Decl. Tl 4. These endeavors were commercial in nature, not personal. The 
information gathered pursuant to the Army's Criminal Livestigation Command (CID) 
investigation pertained to the actions of the Plaintiffs in their commercial or entrepreneurial 
capacity. Thus, any information disclosed pertained solely to the commercial aspect of Plaintiffs' 
dealings with the government. 

Contrary to Plaintiffs assertions that the House Bill is more important in deciphering the 
legislative history of the Privacy Act, this Court has found that the Senate's definition of record 
'"was adopted to more closely reflect the definition of 'personal information' as used in the 
Senate bill.'" Houston v. United States Department of Treasurv , 494 F. Supp. 24, 28 (D.D.C. 
1979) (citing Legislative History of the Privacy Act of 1974, Source Book on Privacy, Senate 
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Comm. on Gov't Operations & House of Representatives Comm. on Gov't Operations (1976) 
(hereinafter Source Book) at 993-94). The definition of "personal information" in the Senate bill 
refers to information about an individual, which excludes information about "proprietorships, 
businesses, and corporations." S.Rep.l 183, 93d Cong., 2d Sess. 79 (1974). Therefore, this Court 
should find that the legislative history of the Privacy Act does intend to distinguish between 
personal information and non-personal information. 

In Houston , an IRS agent alleged that the IRS violated the Privacy Act by failing to give 
the agent written notice that certain information concerning his case assignments were placed in 
his personnel file and later used against him in an adverse personnel action. Id at 25. The 
information, in the form of notes, recorded "the substance of conversations between [the IRS 
agent] and his supervisors concerning four tax audits", including when the agent could complete 
the audits, the status of the audits the agent was performing, the agent's calculation of 
depreciation and bad debt reserves, the hours the agent expended on certain audits, and the 
agent's identification of the issues involved in the audits. Id at 26. The Court granted summary 
judgment in favor of the defendants because the "information transmitted here relates directly to 
official government business. Standing by itself, or otherwise, it reveals nothing about the 
plaintiffs private affairs so as to trigger the protective provisions of the Privacy Act." Id at 28- 
29. 

Houston further stated that, after reading the definition of record and the Committee staff 
analysis, "it is clear that the Act protects only 'personal' information, and while the language of 
the statute itself suggests that this definition should not be read too restrictively, it plainly does 
not encompass the type of information supplied by plaintiff to his supervisors, information which 
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plaintiff himself does not characterize as 'personal.'" Id at 28. Houston found a "clear 
indication that the Congress did not intend the Act to apply to all information in the 
Government's hands. Rather, Congress sought to avoid indiscriminate circulation of sensitive 
information about an individual's private affairs among government agencies." Id at 27. 

Plaintiffs admit in their Complaint at paragraph 46 and again on page 14 of their 
Response that the information disclosed was about "both Plaintiffs' financial transactions in the 
surety bond arena." Thus, the information was entrepreneurial in nature and was not Plaintiffs 
personal information. Because the information contained in the CAN was purely entrepreneurial 
in nature, reflecting Plaintiffs actions in a business capacity, this Court should dismiss Plaintiffs 
Complaint for lack of standing. 

The Privacy Act generally prohibits an agency from disclosing a record about an 
individual. 5 U.S.C. § 552a (b). A record is defined as "any item, collection, or grouping of 
information that is maintained by an agency. . . " 5 U.S.C. § 552a (a)(4). To establish a violation 
of the Privacy Act, a plaintiff must show that the information in question is covered by the Act as 
a "record" contained within a "system of records." 5 U.S.C. § 552a (b). To qualify as a record 
the information must (1) contain the individual's name or other identifying particular and (2) be 
"about" the individual. Tobey v. N.L.R.B. , 40 F.3d 469, 471 (D.C. Cir. 1994). "The fact that the 
information contains an individual's name does not mean that the information is 'about' the 
individual." Id. 

Henke v. Dep't of Commerce , No. 94-189, 1995 WL 904918, at *2 (D.D.C. May 26, 
1995), vacated and remanded on other grounds, 83 F.3d 1453 (D.C. Cir. 1996) an unpublished 
opinion cited by plaintiff, found that the act granted an individual a right of access to records 
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"about the individual" even if found in a corporate record. The D.C. Circuit reversed finding that 

because the agency did not retrieve by the individual's name the records were not in a system of 

records. Unlike the records in Henke , the information in the CAN is not about the Plaintiffs. The 

information contained in the CAN is about the Plaintiffs' business entities (including individual 

sureties) and their business dealings with construction companies and the government. The CAN 

is entitled, Insurance Fraud - Bonding and Surety, and states at the opening, "The following 

individual and entities have been selling and advertising surety bonds to construction companies 

(several addresses have been identified for each individual and business)." The CAN lists the 

names of the three named Plaintiffs along with the name of their business entity and business 

address. The fact that information contains an individual's name does not mean that the 

information is about the individual. Tobey , 40 F.3d at 471 . Despite the fact that the CAN 

contains the names of the individual Plaintiffs, it is not about the individuals, it is about their 

business pursuits. 

II. Count II Should Be Dismissed Because Special Agent Hamblen Made No Disclosure 
To First Bank in Violation of the Privacy Act. 

hi Count n of their Complaint, Plaintiffs allege that Special Agent Hamblen intentionally 

and/or willfiiUy disclosed Privacy Act protected information by means of Hamblen's June 21, 

2005 letter to First Bank. Special Agent Hamblen's letter to First Bank requested specific 

information from First Bank, whether any of the named Plaintiffs or their businesses had a 

relationship with First Bank. Special Agent Hamblen particularly sought confirmation that 

Plaintiff Gowen, and his business. First Mountain Bancorp, had an association with First Bank as 

Plaintiff Gowen had represented. 
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Plaintiffs have identified no Privacy Act protected information released in the letter or the 

irrevocable trust receipt, the First Mountain Bancorp letter, or the list of businesses and 

individuals attached to the letter. 

A record is any item, collection, or grouping of information about an individual 
that is maintained by an agency, including but not limited to, his education, 
financial transactions, medical history, and criminal or employment history and 
that contains his name or other identifying particular assigned to the individual, 
such as a finger or voice print or a photograph. 

5 U.S.C. § 552a(a)(4). 

hi requesting information from First Bank, Agent Hamblen revealed no records. Agent 
Hamblen merely provided the names of the individuals and businesses that had been made 
known to him in the course of his investigation. This was provided in an attempt to determine if 
First Bank had an association with any of the subjects of the investigation. He provided a letter 
from Mr. Gowen on First Mountain Bancorp letterhead (which references an affiliation with First 
Bank) and an irrevocable trust receipt (ITR) from Gowen and First Mountain Bancorp. Plaintiffs 
can hardly argue that release of the ITR and the letter from Plaintiff Gowen are protected by the 
Privacy Act when the documents were submitted by Plaintiff Gowen on a government contract 
and were part of a GAO protest. Hamblen Declaration, ]} 7. 

The list of names attached to Agent Hamblen's letter is also not a record. The list 
contains the names and businesses of Plaintiffs and states that the names on the list are currently 
being investigated by Agent Hamblen's office for fi-audulent surety bonds. Nothing in the list of 
names and businesses contains any personal information about the Plaintiffs. 

Agent Hamblen was conducting a law enforcement investigation as an investigator with 
the Army Criminal Investigation Command. In that capacity, he sent a request for information to 
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First Bank in Creve Coeur, Missouri. Agent Hamblen is authorized to request financial 
information pursuant to Army Regulation 190-6, Obtaining Information From financial 
Institutions, while conducting an investigation. To follow Plaintiffs' argument that Agent 
Hamblen disclosed Privacy Act protected information in his letter to First Bank would lead to the 
illogical conclusion that whenever an investigator identifies the name of an individual as being 
the subject of an investigation, that investigator violates the Privacy Act. Such a result is surely 
not intended by the Privacy Act. Special Agent Hamblen did not make any disclosures in 
violation of the Privacy Act and only revealed enough information to elicit a response from First 
Bank. Agent Hamblen provided no record to First Bank as defined by the Privacy Act. Neither 
the letter itself, nor its attachments contained any personal information about the Plaintiffs. 

III. Counts III and IV Should Be Dismissed Because Mr. Greenway Did Not Disclose 
Privacy Act Protected Information. 

In their opposition brief. Plaintiffs argue that Mr. Greenway, by writing to Plaintiff 
Wright's counsel that Plaintiff Scarborough was "another convicted felon" and by referencing 
Wright and Scarborough's joint business activities, that Mr. Greenway improperly disclosed 
Privacy Act protected information. PL 0pp. P. 23. Plaintiffs likewise argue that Mr. Greenway, 
in a letter to Plaintiff Scarborough's counsel improperly disclosed Privacy Act protected 
information by stating that Wright "was convicted of surety bond fraud in the early 1990's" and 
providing details of Scarborough's and Wright's financial and business transactions. PL 0pp. P. 
23. 

First, any business activities described in the letters about the business activities of 
Plaintiffs Scarborough and Wright were not about the individuals but about their business 
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dealings. Second, their business dealings that are described in the letters to counsel for the other 

Plaintiff merely indicated that Scarborough and Wright had endeavored to conduct business with 

the government jointly. Mr. Greenway's letter to Plaintiff Wright's counsel states that Mr. 

Wright and Mr. Scarborough "have jointly met with government officials in an effort to convince 

such officials to accept 'trust receipts' from First Mountain Bancorp as security for bonds on 

federal contracts." Greenway Declaration, Enclosure 5. In his letter to Plaintiff Scarborough's 

counsel, Mr. Greenway stated: 

Mr. Scarborough has proposed using assets of Underwriters Reinsurance 
Company, Limited, Mr. Wright's organization headquartered in the Caribbean, as 
security for bonds. In addition, Mr. Wright and Mr. Scarborough have jointly met 
with government officials in an effort to convince such officials to accept trust 
receipts from First Mountain Bancorp as security for bonds on federal contracts. 

Greenway Declaration, Enclosure 4. 

Thus, the extent to which Mr. Greenway revealed financial information about 
Scarborough and Wright to the counsel of the other, consisted merely of disclosing the fact that 
the two Plaintiffs had jointly sought to do business with the government. This information can 
hardly be said to be a secret and clearly does not invoke any of the protections of the Privacy Act. 

With regard to the information in Mr. Greenway's letters referring to Plaintiffs 
Scarborough and Wright as convicted felons, this information is not protected by the Privacy Act 
for two reasons. First, there is no right to Privacy in one's criminal record. Criminal records are 
public matters. Paul v. Davis , 424 U.S. 693, 695-6 (1976). Mr. Greenway states in his 
declaration that the information concerning the convictions of Plaintiffs Scarborough and Wright 
was gained through public records. Greenway Declaration, Tj 1 1 . Mr. Greenway was able to 
access this information using his LEXIS-NEXIS account. The D.C. Circuit has held that when a 

8 
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release consists merely of information to which the general public already has access, or which 
the recipient of the release already knows, the Privacy Act is not violated. HoUis v. U.S. Dep't of 
Army , 856 F.2d 1541, 1545 (D.C. Cir. 1988) 

The second reason why the statement in Mr. Greenway's letters referring to Plaintiffs as 
convicted felons is not protected by the Privacy Act is that this information did not come from a 
system of records. The Privacy Act defines system of records as, "a group of any records under 
the control of any agency from which information is retrieved by the name of the individual or by 
some identifying number, symbol, or other identifying particular assigned tot he individual." 5 
U.S.C. § 552a(a)(5). The LEXIS-NEXIS database from which Mr. Greenway obtained the 
criminal history of the two Plaintiffs is not maintained by the agency and is not under the 
agency's control. Therefore, it is not a system of records. Since the information regarding 
Plaintiffs' criminal convictions is publicly available and not maintained in an agency system of 
records, Mr. Greenway's mention of the Plaintiffs' criminal history in letters to counsel is not a 
violation of the Privacy Act. 

IV, Contracting Officials have a Need to Know the Information in the CAN 
Agent Hamblen had reason to believe that Plaintiffs were involved in issuing fraudulent 
bonds on Department of the Army contracts. Defendant's Exhibit 2, to Motion to Dismiss or in 
the alternative for partial summary judgment (DEX 2) ][ 4. Agent Hamblen's investigation had 
revealed that these fraudulent bonds had been issued on numerous Army contracts, as well as 
contracts with the Department of the Air Force, Department of the Navy and other Federal 
Agencies outside the Department of Defense. DEX 2 ]{ 4. Agent Hamblen's release of the 
CAN to LTC Feck of the Defense Acquisition University (DAU) and DAUs subsequent 
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dissemination of the CAN to all procurement officials was pursuant to a need to know. Plaintiffs 

admit that Contracting Officers have a duty to ensure that contracts are adequately bonded. PL 

Opposition p. 33. Given the widespread nature of the fraud involved, dissemination of the CAN 

to all procurement officials was the only means available to ensure that these officials had the 

information necessary to fulfill this duty. 

Criminal Investigation Command Regulation 195-5 governs the use of CANs. That 

regulation provides: 

The Criminal Alert Notice (CAN). The purpose of a CAN is to expedite the 
reporting of perishable information to organizations external to CID. A CAN 
will be used for the dissemination of crime related, time sensitive information 
such as serial crime, fraud schemes, bad checks and impersonators. One reason for 
the use of a CAN is to attack the offender's capability of victimizing others and to 
alert high-risk activities (such as exchanges, banks and hospitals) in an event to 
prevent them from being victimized by a given suspect. 

CIDR 195-5 Tl 18-15. As the above quoted passage shows the CAN was created for situations 

like the one faced by SA Hamblen. A fraud scheme is one of the specific uses cited for a CAN, 

undermining Plaintiffs argument that Army Regulation (AR) 27-40 requires the use of a 

different dissemination method. Additionally, CIDR 195-5 specifically contemplates using a 

CAN to alert potential victims, in this case contracting officials. Disclosure of the CAN to the 

contracting officials at DAU was consistent with the need to know exception to the Privacy Act. 

5 U.S.C. § 552a(b)(l). The fact that the Army also has a procurement flash report for 

disseminating information about fraudulent activity does not effect the ability of the Army's 

Criminal Investigation Division to use a Criminal Alert Notice to notify potential victims of an 

on-going fraud scheme. 

Similarly, the declarations fi"om Fernando Guerra and Ann Monies establish that these 

10 
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SBA employees had a need to know the information contained in the CAN. Plaintiff argues that 

Fernando Guerra does not claim a need to know the information. PL Opposition p. 41. However 

the Guerra declaration clearly establishes that he did have a need to know the information. 

Guerra forwarded the email that he received from Ann Montes to 8(a) Business Development 

(BD) Program participants. Declaration of Fernando Guerra; DEX 4. A BOS provides business 

development assistance to active 8(a) Business Development (BD) program participants. The 

section 8(a) BD program is a business development program designed to assist small businesses 

in the federal procurement area. Under SBA's Surety Bond Guarantee (SBG) Program, SBA, an 

8(a) BD program participant, and a surety enter into an surety bond whereby the surety will pay 

another contractor to complete performance of the contract if the participant defaults. Id If the 

bond is fraudulent, the 8(a) participant is not adequately protected. Id Mr. Guerra clearly 

established that he had responsibility to assist (a) Business Development (BD) program 

participants including by helping those participants avoid fraudulent bonds. 

V. The Notice Requirement of the Routine Use Provision Only Applies When the 
Government Is Seeking Information from an Individual 

Plaintiffs site to United States Postal Serv. v. National Ass'n of Letter Carriers , 9 F.3d 

138, 146 (D.C. Cir. 1993) as requiring a third element for application of the routine use exception 

to the Privacy Act. PL Opposition p. 41 . The Court there stated "[i]t will be recalled that the 

Privacy Act mandates that each employee receive actual notice of the routine uses to which 

private information provided by the employee is put." United States Postal Serv. v. National 

Ass'n of Letter Carriers , 9 F.3d 138, 146 (D.C. Cir. 1993) (emphasis added). The information 

gathered in the CAN was not provided by Plaintiff but instead was gathered in the course of a 
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criminal investigation. Obviously a law enforcement official cannot provide actual notice to a 

suspected criminal of the routine uses to which the gathered information may be put. 

VI, Disclosure of the Can to SBA Was Compatible with the Published Routine Use Notice 

Plaintiff argues that Britt v. Naval hivestigative Service , 886 F.2d 544, 547-50 (3d Cir. 
1989) supports Plaintiffs position. In Britt , the Third Circuit noted "[t]he statutory requirement 
of compatibility, however, requires instead a dual inquiry into the purpose for the collection of 
the record in the specific case and the purpose of the disclosure. Britt v. Naval hivestigative 
Service , 886 F.2d 544, 548-549 (3d Cir. 1989). hi that case, because information was gathered to 
investigate one particular crime for possible prosecution release to Britt 's civilian employer, a 
government agency, was not proper. The Court determined that it is undisputed that the 
investigation was for a specific instance of possible wrongdoing rather than for a general inquiry 
into Britt's background. Id. at 549. 

In contrast, SA Hamblen was conducting an investigation into a wide ranging, and on- 
going fraud scheme. DEX 2 ][ 4. Agent Hamblen's two purposes in drafting the CAN were: (1) 
to warn Department of Defense (DoD) contracting officials of the possible fraudulent activity of 
the individual sureties; and (2) to collect information that would be useful to the investigation. 
DEX 2 Tl 5. Both of those uses are compatible with the purposes of the investigation, protecting 
the government from future fraud, and possible prosecution of the perpetrators. Release to the 
SBA serves both those functions. 

The Court in Britt, also endorsed a disclosure similar to CID's disclosure of the CAN to 
DAU. The Court stated: 

[t]he disclosure to the CO is no longer challenged and, in any event, such 

12 
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disclosure would appear to fall within the "right to know" provision governing 
intra-agency transmission of information, see 5 U.S.C. § 552a(b)(l), since the 
Reserves might need to reevaluate Britt's access to sensitive information or the 
level of responsibility he was accorded. 

Britt V. Naval Investigative Service , 886 F.2d 544, 549 (3d Cir. 1989). Similarly in this case, the 

procurement officials at DAU needed the information in the CAN to evaluate Plaintiffs ongoing 

practice of flirnishing surety bonds backed by fraudulent or nonexistent assets. DEX 2 ][ 4. 

VII. Defendants Have Shown That Policies and Procedures Were in Place at Both 
Agencies To Satisfy the Privacy Act, 

Regarding § (e)(6), SB A has made reasonable efforts to ensure that its records are 
accurate, complete, timely, and relevant through the promulgation of regulations and an SOP. 
Although there is a duty to maintain agency records with sufficient accuracy, the mere presence 
of inaccurate information in a record is not an automatic violation of the Privacy Act. White v. 
Office of Personnel Management , 787 F.2d 660, 662 (D.C. Cir. 1986), cert, denied, 479 U.S. 885 
(1986). Indeed, the judgments and evaluation of the Army's investigation were properly retained 
in the record. White , 787 F.2d at 662; Velikonja v. Mueller , HI, 362 F. Supp.2d 1,16 (D.D.C. 
2004) (citing Kleiman v. Department of Energy , 956 F.2d 335, 337-38 (D.C. Cir. 1992)) ("the 
Act, however, is intended to remedy 'factual or historical errors,' and is not a vehicle for 
addressing 'the judgments of federal officials . . . reflected in records maintained by federal 
agencies.'"). 

Regarding §(e)(9), SBA's promulgation of 13 C.F.R. §§ 102.20 through 102.61 are 
sufficient to establish rules of conduct for persons involved in the design, development, operation 
or maintenance of a system of records. As public documents, SB A employees are aware of the 
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Privacy Act requirements. Similarly, Army Regulation 340-21, The Army Privacy Program, also 
found at 32 C.F.R. 505.1, sets forth the policies and procedures governing personal information 
in Department of the Army (DA) systems of records. Further, the Army Criminal Investigation 
Command requires its personnel to thoroughly document investigative information, to maintain 
case folders in the personal custody of CID special agents or within the files system of the CID 
office, and each special agent and supervisor must ensure that personal data is entered into the 
database correctly. DEX 5 Tj 15. 

Finally, regarding §(e)(10), SBAs promulgation of 13 C.F.R. §§ 102.21, 102.22, 102.27 
and SBA's SOP 40.04.03 demonstrate that SBA established the appropriate safeguards. Similarly 
Army policy is to safeguard personal information to prevent unauthorized use, access, disclosure, 
alteration, or destruction. 32 C.F.R. 505.1(e)(4). The Army Privacy Program further requires 
that an official be designated at each location and for each system of records to safeguard 
information in that system. 32 C.F.R. 505.4(d)(2). Resident Agent in Charge Gressley, PFRA, is 
the official who has been designated as the person responsible for safeguarding information at the 
PFRA. DEX 2 Tl 9. 

For plaintiffs to prevail on Counts VIII, IX, XIV, XV, and XVI, the plaintiffs bear the 
burden of proving that the agency either committed the act without grounds for believing it to be 
lawfiil or flagrantly disregarded his rights under the Privacy Act. 5 U.S.C. §552a(g)(4); 
Laningham v. United States Navy , 813 F.2d 1236, 1242 (D.C.Cir.l987); Albright v. United 
States, 732 F.2d 181, 189 (D.C.Cir.l984). As evidenced by the declarations and Army's and 
SBA's regulations and SOPs, there was no flagrant disregard for the Privacy Act requirements in 
§§ (e)(6), (9), and (10). Accordingly, this Court should enter summary judgment in favor of 

14 
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Defendants on Counts VIE, IX, XIV, XV, and XVI. 



CONCLUSION 

For the foregoing reasons and those stated in our Motion to Dismiss or in the Ahemative 
for Partial Summary Judgment, Defendants respectfully request that this Court dismiss plaintiffs' 
amended complaint with prejudice. 

Respectfiilly submitted, 



/s/ 



Of Counsel: 

Major Patrick Gary 

U.S. Army Legal Services Agency 

901 North Stuart Street 



KENNETH L. WAINSTEIN, D.C. Bar #451058 
United States Attorney 



/s/ 



RUDOLPH CONTRERAS D.C. Bar No. 434122 
Assistant United States Attorney 



/s/ 



KEVIN K. ROBITAILLE 

Special Assistant U.S. Attorney 
555 Fourth Street, N.W., 
Washington, D.C. 20530 
(202) 353-9895 
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Arlington, Virginia 22203-1837 

Erika Covarrubias 

Office of General Counsel 

U.S. Small Business Administration 

Washington, DC 

(202) 205-6647 
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